Add license information to SBOM (CycloneDX) outputs

[marcospereira]

Currently, when one runs aube sbom, it generates a CycloneDX SBOM where components entries don't have the licenses files:

{
  "type": "library",
  "bom-ref": "@babel/runtime@7.29.7",
  "name": "@babel/runtime",
  "version": "7.29.7",
  "purl": "pkg:npm/%40babel/runtime@7.29.7"
}

CycloneDX 1.5 spec does have a licenses field that can be used like this:

{
  "type": "library",
  "bom-ref": "@babel/runtime@7.29.7",
  "name": "@babel/runtime",
  "version": "7.29.7",
  "purl": "pkg:npm/%40babel/runtime@7.29.7",
  "licenses": [
    {
      "license": {
        "id": "Apache-2.0"
      }
    }
  ]
}

---

SPDX format does add licenseConcluded and licenseDeclared, but they are always NOASSERTION, as per these comments:

aube/crates/aube/src/commands/sbom.rs

Lines 288 to 293 in 856fef1

	// SPDX 2.3 §7.13/§7.15/§7.17 require these for every package, including
	// the root. We don't read license info from the store yet, so everything
	// is NOASSERTION.
	root_pkg.insert("licenseConcluded".into(), "NOASSERTION".into());
	root_pkg.insert("licenseDeclared".into(), "NOASSERTION".into());
	root_pkg.insert("copyrightText".into(), "NOASSERTION".into());

It seems like Aube would have access to the deps license info, considering that aube licenses exists.

[jdx]

Implemented in #1208.

The fix reuses the installed-package lookup from aube licenses, so it works with isolated, hoisted, and custom virtual-store layouts without network access. CycloneDX now emits SPDX IDs, expressions, or named licenses for both the root and dependency components. SPDX now populates licenseDeclared for valid SPDX expressions while intentionally leaving licenseConcluded as NOASSERTION, since aube is reporting package-author metadata rather than performing license analysis.

Thanks for the detailed report!

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.